Sheldan@programming.dev to Programming@programming.dev · 2 years agoMalicious code injection by compromised pull request branch namesgithub.comexternal-linkmessage-square14linkfedilinkarrow-up163arrow-down12
arrow-up161arrow-down1external-linkMalicious code injection by compromised pull request branch namesgithub.comSheldan@programming.dev to Programming@programming.dev · 2 years agomessage-square14linkfedilink
minus-squareFizzyOrange@programming.devlinkfedilinkarrow-up13·2 years agoWhere’s the code that doesn’t quote this properly? I’m guessing it’s Bash.
minus-squareThinker@lemmy.worldlinkfedilinkarrow-up16·2 years agoDing ding ding! We have a winner! It’s a third-party GitHub Action that is passing the branch name directly to Bash. So to be clear, not GitHub’s fault.
Where’s the code that doesn’t quote this properly? I’m guessing it’s Bash.
Ding ding ding! We have a winner!
It’s a third-party GitHub Action that is passing the branch name directly to Bash. So to be clear, not GitHub’s fault.